Sat May 6 21:37:16 2017 UTC ()
Fix CVE-2016-10268, ref.
http://bugzilla.maptools.org/show_bug.cgi?id=2598
https://github.com/vadz/libtiff/commit/5397a417e61258c69209904e652a1f409ec3b9df
Bump PKGREVISION.


(he)
diff -r1.132 -r1.133 pkgsrc/graphics/tiff/Makefile
diff -r1.78 -r1.79 pkgsrc/graphics/tiff/distinfo
diff -r1.2 -r1.3 pkgsrc/graphics/tiff/patches/patch-tools_tiffcp.c
cvs diff -r1.132 -r1.133 pkgsrc/graphics/tiff/Makefile (expand / switch to unified diff)

--- pkgsrc/graphics/tiff/Makefile 2017/05/06 21:29:16 1.132
+++ pkgsrc/graphics/tiff/Makefile 2017/05/06 21:37:16 1.133
@@ -1,17 +1,17 @@ @@ -1,17 +1,17 @@
1# $NetBSD: Makefile,v 1.132 2017/05/06 21:29:16 he Exp $ 1# $NetBSD: Makefile,v 1.133 2017/05/06 21:37:16 he Exp $
2 2
3DISTNAME= tiff-4.0.7 3DISTNAME= tiff-4.0.7
4PKGREVISION= 8 4PKGREVISION= 9
5CATEGORIES= graphics 5CATEGORIES= graphics
6MASTER_SITES= ftp://download.osgeo.org/libtiff/ 6MASTER_SITES= ftp://download.osgeo.org/libtiff/
7 7
8MAINTAINER= pkgsrc-users@NetBSD.org 8MAINTAINER= pkgsrc-users@NetBSD.org
9HOMEPAGE= http://simplesystems.org/libtiff/ 9HOMEPAGE= http://simplesystems.org/libtiff/
10COMMENT= Library and tools for reading and writing TIFF data files 10COMMENT= Library and tools for reading and writing TIFF data files
11LICENSE= mit 11LICENSE= mit
12 12
13EXTRACT_ONLY= ${DISTNAME}${EXTRACT_SUFX} 13EXTRACT_ONLY= ${DISTNAME}${EXTRACT_SUFX}
14 14
15USE_LANGUAGES= c c++ 15USE_LANGUAGES= c c++
16USE_LIBTOOL= yes 16USE_LIBTOOL= yes
17GNU_CONFIGURE= yes 17GNU_CONFIGURE= yes
cvs diff -r1.78 -r1.79 pkgsrc/graphics/tiff/distinfo (expand / switch to unified diff)

--- pkgsrc/graphics/tiff/distinfo 2017/05/06 21:29:16 1.78
+++ pkgsrc/graphics/tiff/distinfo 2017/05/06 21:37:16 1.79
@@ -1,25 +1,25 @@ @@ -1,25 +1,25 @@
1$NetBSD: distinfo,v 1.78 2017/05/06 21:29:16 he Exp $ 1$NetBSD: distinfo,v 1.79 2017/05/06 21:37:16 he Exp $
2 2
3SHA1 (tiff-4.0.7.tar.gz) = 2c1b64478e88f93522a42dd5271214a0e5eae648 3SHA1 (tiff-4.0.7.tar.gz) = 2c1b64478e88f93522a42dd5271214a0e5eae648
4RMD160 (tiff-4.0.7.tar.gz) = 582e19c31e7f29d9ed36995dcad7ad68802cbadb 4RMD160 (tiff-4.0.7.tar.gz) = 582e19c31e7f29d9ed36995dcad7ad68802cbadb
5SHA512 (tiff-4.0.7.tar.gz) = 941357bdd5f947cdca41a1d31ae14b3fadc174ae5dce7b7981dbe58f61995f575ac2e97a7cc4fcc435184012017bec0920278263490464644f2cdfad9a6c5ddc 5SHA512 (tiff-4.0.7.tar.gz) = 941357bdd5f947cdca41a1d31ae14b3fadc174ae5dce7b7981dbe58f61995f575ac2e97a7cc4fcc435184012017bec0920278263490464644f2cdfad9a6c5ddc
6Size (tiff-4.0.7.tar.gz) = 2076392 bytes 6Size (tiff-4.0.7.tar.gz) = 2076392 bytes
7SHA1 (patch-configure) = a0032133f06b6ac92bbf52349fabe83f74ea14a6 7SHA1 (patch-configure) = a0032133f06b6ac92bbf52349fabe83f74ea14a6
8SHA1 (patch-html_man_Makefile.in) = 705604e2a3065da192e7354a4a9cdcd16bd6823d 8SHA1 (patch-html_man_Makefile.in) = 705604e2a3065da192e7354a4a9cdcd16bd6823d
9SHA1 (patch-libtiff_tif__luv.c) = c2e8ce7474119ffa02d226932ad6c8c2b230062c 9SHA1 (patch-libtiff_tif__luv.c) = c2e8ce7474119ffa02d226932ad6c8c2b230062c
10SHA1 (patch-libtiff_tif__pixarlog.c) = ad16681cf3fcb5fded048eb70c0a93f1b6447147 10SHA1 (patch-libtiff_tif__pixarlog.c) = ad16681cf3fcb5fded048eb70c0a93f1b6447147
11SHA1 (patch-libtiff_tif__strip.c) = f7dc7b24378d0541a8f3bcc3cad78ea2d6ae14d7 11SHA1 (patch-libtiff_tif__strip.c) = f7dc7b24378d0541a8f3bcc3cad78ea2d6ae14d7
12SHA1 (patch-libtiff_tif_dir.c) = 28c45b95cedeebe005b44b45393d66f61e0ea6f7 12SHA1 (patch-libtiff_tif_dir.c) = 28c45b95cedeebe005b44b45393d66f61e0ea6f7
13SHA1 (patch-libtiff_tif_dirread.c) = f6d442da817457d7ac801a3005e21c357ac31f8a 13SHA1 (patch-libtiff_tif_dirread.c) = f6d442da817457d7ac801a3005e21c357ac31f8a
14SHA1 (patch-libtiff_tif_dirwrite.c) = 07ccbf8cf210b95d5ca7710cc2982368783b4dcb 14SHA1 (patch-libtiff_tif_dirwrite.c) = 07ccbf8cf210b95d5ca7710cc2982368783b4dcb
15SHA1 (patch-libtiff_tif_getimage.c) = 267b555c8b043d0a835db4d46ef65131776601e6 15SHA1 (patch-libtiff_tif_getimage.c) = 267b555c8b043d0a835db4d46ef65131776601e6
16SHA1 (patch-libtiff_tif_jpeg.c) = 1049b7b243e9e145886bcac8e68e5e7889337ebc 16SHA1 (patch-libtiff_tif_jpeg.c) = 1049b7b243e9e145886bcac8e68e5e7889337ebc
17SHA1 (patch-libtiff_tif_ojpeg.c) = 6447168e952bb80a1a8272c2c27bb0ce3ccf6939 17SHA1 (patch-libtiff_tif_ojpeg.c) = 6447168e952bb80a1a8272c2c27bb0ce3ccf6939
18SHA1 (patch-libtiff_tif_read.c) = 85674d2e222846e3971301ce2fb7ebe02f54b9b2 18SHA1 (patch-libtiff_tif_read.c) = 85674d2e222846e3971301ce2fb7ebe02f54b9b2
19SHA1 (patch-libtiff_tif_unix.c) = c8312771e567f90de0f77ac8eb66ed5c36e35617 19SHA1 (patch-libtiff_tif_unix.c) = c8312771e567f90de0f77ac8eb66ed5c36e35617
20SHA1 (patch-libtiff_tif_win32.c) = 1ea9dcb6618c40b9de3e8d2a81914355f2111fdc 20SHA1 (patch-libtiff_tif_win32.c) = 1ea9dcb6618c40b9de3e8d2a81914355f2111fdc
21SHA1 (patch-libtiff_tiffio.h) = e0efa9e1246e07dbb3a69d626988a18f12ba9d3c 21SHA1 (patch-libtiff_tiffio.h) = e0efa9e1246e07dbb3a69d626988a18f12ba9d3c
22SHA1 (patch-man_Makefile.in) = ff073529c9d3ab98a03efa7d98c3263c1782482f 22SHA1 (patch-man_Makefile.in) = ff073529c9d3ab98a03efa7d98c3263c1782482f
23SHA1 (patch-tools_tiff2pdf.c) = ce7a3e77c27ad3cabaa33b5da61cbd1b27f187d1 23SHA1 (patch-tools_tiff2pdf.c) = ce7a3e77c27ad3cabaa33b5da61cbd1b27f187d1
24SHA1 (patch-tools_tiffcp.c) = 42573d15fc66655a09e9227213b0929238f7e651 24SHA1 (patch-tools_tiffcp.c) = bd6abd9dc6e044ff04d761d999fabfb0919ba0db
25SHA1 (patch-tools_tiffcrop.c) = 1d729028fb8c05de958424234d5cc2808acc9b25 25SHA1 (patch-tools_tiffcrop.c) = 1d729028fb8c05de958424234d5cc2808acc9b25
cvs diff -r1.2 -r1.3 pkgsrc/graphics/tiff/patches/Attic/patch-tools_tiffcp.c (expand / switch to unified diff)

--- pkgsrc/graphics/tiff/patches/Attic/patch-tools_tiffcp.c 2017/05/05 20:06:03 1.2
+++ pkgsrc/graphics/tiff/patches/Attic/patch-tools_tiffcp.c 2017/05/06 21:37:16 1.3
@@ -1,37 +1,52 @@ @@ -1,37 +1,52 @@
1$NetBSD: patch-tools_tiffcp.c,v 1.2 2017/05/05 20:06:03 he Exp $ 1$NetBSD: patch-tools_tiffcp.c,v 1.3 2017/05/06 21:37:16 he Exp $
2 2
3CVE-2017-5225 3CVE-2017-5225
4http://bugzilla.maptools.org/show_bug.cgi?id=2656 4http://bugzilla.maptools.org/show_bug.cgi?id=2656
5http://bugzilla.maptools.org/show_bug.cgi?id=2657 5http://bugzilla.maptools.org/show_bug.cgi?id=2657
6https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7 6https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7
7 7
8and 8and
9 9
10CVE-2016-10093 10CVE-2016-10093
11http://bugzilla.maptools.org/show_bug.cgi?id=2610 11http://bugzilla.maptools.org/show_bug.cgi?id=2610
12https://github.com/vadz/libtiff/commit/787c0ee906430b772f33ca50b97b8b5ca070faec 12https://github.com/vadz/libtiff/commit/787c0ee906430b772f33ca50b97b8b5ca070faec
13 13
 14and
 15
 16CVE-2016-10268
 17http://bugzilla.maptools.org/show_bug.cgi?id=2598
 18https://github.com/vadz/libtiff/commit/5397a417e61258c69209904e652a1f409ec3b9df
 19
14--- tools/tiffcp.c.orig 2016-10-12 01:45:17.000000000 +0000 20--- tools/tiffcp.c.orig 2016-10-12 01:45:17.000000000 +0000
15+++ tools/tiffcp.c 21+++ tools/tiffcp.c
16@@ -592,7 +592,7 @@ static copyFunc pickCopyFunc(TIFF*, TIFF 22@@ -592,7 +592,7 @@ static copyFunc pickCopyFunc(TIFF*, TIFF
17 static int 23 static int
18 tiffcp(TIFF* in, TIFF* out) 24 tiffcp(TIFF* in, TIFF* out)
19 { 25 {
20- uint16 bitspersample, samplesperpixel = 1; 26- uint16 bitspersample, samplesperpixel = 1;
21+ uint16 bitspersample = 1, samplesperpixel = 1; 27+ uint16 bitspersample = 1, samplesperpixel = 1;
22 uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK; 28 uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
23 copyFunc cf; 29 copyFunc cf;
24 uint32 width, length; 30 uint32 width, length;
 31@@ -985,7 +985,7 @@ DECLAREcpFunc(cpDecodedStrips)
 32 tstrip_t s, ns = TIFFNumberOfStrips(in);
 33 uint32 row = 0;
 34 _TIFFmemset(buf, 0, stripsize);
 35- for (s = 0; s < ns; s++) {
 36+ for (s = 0; s < ns && row < imagelength; s++) {
 37 tsize_t cc = (row + rowsperstrip > imagelength) ?
 38 TIFFVStripSize(in, imagelength - row) : stripsize;
 39 if (TIFFReadEncodedStrip(in, s, buf, cc) < 0
25@@ -1068,6 +1068,16 @@ DECLAREcpFunc(cpContig2SeparateByRow) 40@@ -1068,6 +1068,16 @@ DECLAREcpFunc(cpContig2SeparateByRow)
26 register uint32 n; 41 register uint32 n;
27 uint32 row; 42 uint32 row;
28 tsample_t s; 43 tsample_t s;
29+ uint16 bps = 0; 44+ uint16 bps = 0;
30+ 45+
31+ (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps); 46+ (void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
32+ if( bps != 8 ) 47+ if( bps != 8 )
33+ { 48+ {
34+ TIFFError(TIFFFileName(in), 49+ TIFFError(TIFFFileName(in),
35+ "Error, can only handle BitsPerSample=8 in %s", 50+ "Error, can only handle BitsPerSample=8 in %s",
36+ "cpContig2SeparateByRow"); 51+ "cpContig2SeparateByRow");
37+ return 0; 52+ return 0;